[chrischeng-c4]

Why

Local kind clusters fight for the same 10 CPU and 31 GB. This moves Kubernetes tests to a new zonal GKE cluster faberline-test (project axiom-502607; a project ID cannot change): one namespace and one node pool per repository, and every pool at 0 nodes between runs.

Who owns what

Owner	Owns
aw	Cluster, node pools and their max size (infra/gke-test/pools.yaml), identities, the shared workflow, the scripts, the reaper
Each repository	k8s/overlays/gke-test/, its image build to GHCR, its test command

What is in this PR

• infra/gke-test/: Terraform. Creates the cluster faberline-test and its node service account, with only these pools:
  • system-pool: e2-standard-2 Spot, no autoscaling. wake.sh sets it to 1; park.sh sets it to 0.
  • pool-<repo> for each row of pools.yaml: 0..max_nodes, label and taint faberline.dev/pool=<repo>.
  • WIF pool faberline-github (any repository under faberline), one gke-test-<repo> service account per row, and gke-test-reaper.
• infra/gke-test/bootstrap/: the state bucket axiom-502607-faberline-tfstate.
• .github/workflows/gke-test.yml: reusable workflow. Render and check the overlay, deploy, run the test command, always tear down, upload evidence.
• .github/workflows/gke-test-reaper.yml: every 30 minutes, delete expired test namespaces, park system-pool, delete orphan pvc-* disks, and report pods outside test namespaces. A failed run opens one issue; the next clean run closes it. It runs only after this PR is on main.
• Budget: google_billing_budget.test, 650 TWD (about US$20) a month, emails at 50%, 90%, 100%, and 100% forecast. The billing account ID comes from the project, not from this public repository.
• scripts/gke-test/: run.sh, teardown.sh, wake.sh, park.sh, reap.sh.
• docs/standards/test-cluster.md: the guideline for repositories.

Differences from the approved plan

• Deployers get cluster-admin, not a custom ClusterRole. A run creates ClusterRoles and bindings, which needs bind and escalate, which equal cluster-admin.
• A new WIF pool, not a wider workspace pool. The workspace bootstrap was never applied, so there was nothing to widen.
• A new cluster, not the old axiom-operator-acceptance. The repositories moved from axiom to faberline, and a cluster cannot be renamed. The old cluster was empty and is deleted by hand.
• The cluster uses the OPTIMIZE_UTILIZATION autoscaling profile, so idle repository nodes go away sooner.
• system-pool is e2-standard-2, not e2-medium. kube-system requests about 700m plus DaemonSets.

Checks

• shellcheck -x -S warning scripts/gke-test/*.sh
• actionlint on both workflows
• terraform fmt -check and terraform validate
• Bootstrap applied with owner approval: bucket axiom-502607-faberline-tfstate exists.
• terraform plan against that bucket: 18 to add, 0 to change, 0 to destroy.
• run.sh render check, on a copy of keep: the template overlay fails with the 3 missing placement items; the gke-test overlay passes. Teardown order is the exact reverse of the rendered order.
• terraform apply of infra/gke-test with owner approval: 18 added. A new terraform plan shows no changes.
• Cleanup with owner approval: 34 unattached pvc-* disks (331 GB) deleted; project display name is now faberline; old cluster axiom-operator-acceptance deleted.
• End-to-end run from keep (feat(gke-test): test keep on the shared faberline GKE cluster keep#6), run 38695988056: attempt 1 failed in wake.sh (rollout status on kube-dns hit its old progress deadline); teardown still deleted the namespace. Fixed with kubectl wait --for=condition=Available. Attempt 2 passed: readyz, round trip, and data survives a pod restart. Teardown parked system-pool; afterwards the project had 0 VMs and 0 disks.
• terraform plan for the reaper and budget changes: 4 to add, 1 to change (reaper ClusterRole), 0 to destroy.
• terraform apply of the reaper and budget changes with owner approval: 4 added, 1 changed. A new terraform plan shows no changes.

🤖 Generated with Claude Code